552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663

Sharing

Copy URL Twitter E-mail

General

Target
VapeV4.exe
Size 68.7MB
Sample260503-2s34vsds7p
SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
MD5 6f1e056461acd015fa479b9858f0f791
SHA1 d37bd203acaf1c74e2f81314f6bea032b98cff82
SHA512 e29b7e275184c2e5107753bc10a91c906eca14a7b6fe63f2018b7a23aa80106dbad85d3b15828484f6eec14fedd6f26efa821ad1126be9f5377ca61cf7d31e86
SSDEEP 1572864:J4gRhxekCDPmeCJQtiHfpDRbaEer2heiYYB/AvN08Wmln7:J481CDfhoHxDJaXkMI/INn57
TLSH
T1E3F7331D661E635EFC3DA6F798CD6789C31AFE5A0B9237354C28807AF918B7424CD206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VapeV4.exe
- Size 68.7MB
- SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
- MD5 6f1e056461acd015fa479b9858f0f791
- SHA1 d37bd203acaf1c74e2f81314f6bea032b98cff82
- SHA512 e29b7e275184c2e5107753bc10a91c906eca14a7b6fe63f2018b7a23aa80106dbad85d3b15828484f6eec14fedd6f26efa821ad1126be9f5377ca61cf7d31e86
- SSDEEP 1572864:J4gRhxekCDPmeCJQtiHfpDRbaEer2heiYYB/AvN08Wmln7:J481CDfhoHxDJaXkMI/INn57
- TLSH
  T1E3F7331D661E635EFC3DA6F798CD6789C31AFE5A0B9237354C28807AF918B7424CD206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/app-64.7z
- Size 68.3MB
- SHA256 c3c7f9484150a203cc152af74fefa5dc595404d2ffb6feb5c62dd58871f8a1e9
- MD5 00e61a4350c02c9dfc3be8cdfb4ed31d
- SHA1 5df180c786aa09dcc804fb34edaa2e0e31cf7da3
- SHA512 4099bbe7930ff8e110e2a5f78220ec9c027e930566c5637d37a08455aa332a973d4bf50b8deb33454b91129223ba6c3af32a0ec8b9a3454151d9396d3f9f565b
- SSDEEP 1572864:34gRhxekCDPmeCJQtiHfpDRbaEer2heiYYB/AvN08Wmlx:3481CDfhoHxDJaXkMI/INnH
- TLSH
  T1B3F7331D661E635EFC3DA6E798CD6788C31AFE5A4F9237354C28847AF908B7424CD206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

3^/10

ransomware
behavioral5
- Target
  chrome_100_percent.pak
- Size 132KB
- SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
- MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
- SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
- SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
- SSDEEP 3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
- TLSH
  T185D3D0D7B3F4EE7DCA6756F7A62540B1ECB386280691434B078BD8752A26748DCC8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  chrome_200_percent.pak
- Size 190KB
- SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
- MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
- SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
- SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
- SSDEEP 3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
- TLSH
  T1ED14E1C7A3B8DD7DC9670AB3662501F1ECB211395AB6525B03DFDC357A56BC888C8283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- MD5 e0f1ad85c0933ecce2e003a2c59ae726
- SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
- TLSH
  T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  locales/af.pak
- Size 446KB
- SHA256 2b7a1625342c2b34fd220dba6b416786595dbf625948f5be7ddc52bf7e7116d2
- MD5 6b8c0f6213208fe201ffc8218a51fc20
- SHA1 12bc414da10964c11c31a3a44f0a76352b94724f
- SHA512 9544568bae24a193f81ca84f5c4041d8c69f4b05c73ed5a4e216d4f3a948de8c28c66ef93d21e0c80763c13ff35197969cbf18d4759a0dc3e2f8c57ad56ade48
- SSDEEP 12288:+R2loaNOk0o+wZqSMKVQ2uM2Z12JynAyPIVfNdgSTCSQ2fs37KvOb5t/tn6Abiay:VDck0ofcSMaTuM2Z12JynAyPIVfNdgS3
- TLSH
  T19EA42C06DB91273D09A07696BB0846F7BF9CA26CD770B2BADD9D82360562EFC017D1C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  locales/am.pak
- Size 726KB
- SHA256 fd0d603e89b2514572f8c03f7479f395b2012bd5ccbeb89366b813e8f02a557f
- MD5 cad8ef0ed379d74fac45391c6dcbb14d
- SHA1 7085b80b08bf88ba5cb4d634f2e1a5be6a4f2b91
- SHA512 1f91700d06d30db22821a9ccbf1e743d1490588e0ccdef08fcb18d9444d75593e98ea35e5d69f20ac921bf4ae2b385cdf8f2e7610f0968be36dae78cfdc708be
- SSDEEP 12288:ewwXTZou7fVIx2TERZ3ej5dMNzLY5t9ZSVrBO0Pcx30jH8+F:epXTZlVIxJRZuj5dMNzLY5t9ZSVrBO0d
- TLSH
  T183F499547EF9F7570F8E8A19A4320E4E9594AD4652813C38C35AD3FC2B2EF1B4DDA218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  locales/ar.pak
- Size 793KB
- SHA256 c141fab5d80ef650198ee0e396d14f96cab75c39299e396788efaab5e8543e87
- MD5 a5b81a0af153899c92bf6966b778fafd
- SHA1 bf18447f668bd284bc37116a0e9018e446642cc2
- SHA512 693d94eda17ee0b3d9865557071b5632e15bfc3180f7c78195d961e5825ad13bc0f35645f0c2ea52d46a4cfe5815d06211a6d61ad9162851926c10e06e244ada
- SSDEEP 12288:zGnCr1B0h5/N/REWH4LzWvwU5Twik9b5uNiH+32qeTT:zECIER75D+w
- TLSH
  T19C059BE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E74E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  locales/bg.pak
- Size 827KB
- SHA256 bc7047b3d87646a5350cbdf983ea859b97a49a82e5a13d91ec1c410de6ee087b
- MD5 47891446a74834aabd2c5d6e5eea7c9a
- SHA1 0e0b36a3afda165df00f3bb10624e3d2591c15de
- SHA512 d4802b616779cd5a204be5fc439778afa86192aaea0b94cf10bde3afb2ef3774076c30e6aa5d6edbd3dd7368b9ae0401eab1d4e75bdae5d02774826b591bcb45
- SSDEEP 24576:64uChsqfaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao51JqueRSnQFwN/e:64uChsqfaElYtUjHh373Z53a1kVDgQw3
- TLSH
  T13C0524A15B9A68DF0101F45F98087E093CEB94FE3FE7879241642DBD39F10B486BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral12
- Target
  locales/bn.pak
- Size 1.0MB
- SHA256 8ad04a66e23db319fe3195d1309569b9b35e65571c69376bf39a4e79460b557c
- MD5 bbd111c6479de0c6753e5e29a41ada10
- SHA1 eb29c2ba8ced9e060a1ae4efa435f9b4b273ef13
- SHA512 055b565c990cb2f5b21558595fc0968d99c102595aa9a53ece7be5a61d3c474c74daca7ad3c24d534e9ea2404350e71d9bbcb698353c202537f782c3db07e498
- SSDEEP 3072:Tc2mIp84RjQJFQPFESdYObWEKNm2EadKZ0ZfQ0/QeIyTEPukkBBbpUDDM5ciXldW:wbIqqVF9d9KN+2IyoPubBbf5FlI
- TLSH
  T15935EE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A24938ADC3C8DADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13
- Target
  locales/ca.pak
- Size 503KB
- SHA256 3666b428ed75fa7ad06d812fbfef6b7c9d80300da4bf1d8b0f78a52046c43f4d
- MD5 ba3a70c271a87c53d7f36483e11dd035
- SHA1 962680e8825ef25463658fc74b660d5315c3458e
- SHA512 b6a5764d70e9b2e55f2609477f1bb2d568ea7eb8e51ce7bdec54b6b5221646e5927db5bdac0e3bfe61542eba0109ac05b6a0a2c4788d3674511316c37ca992a6
- SSDEEP 12288:AuZS8LVt4Y7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJX:3S8LvP4V8R2S9lMN4MZRg5/5Uiq
- TLSH
  T16DB409239FC93B6744D2320AFB46C217F48CA9847B06D254F5AE1B1622CCADCC677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral14
- Target
  locales/cs.pak
- Size 517KB
- SHA256 359b49b141d15256b76cc1fa50eda0829abac7f0e8cc20e41455dd65e87e20e2
- MD5 208a0b0f999e2e835f986b062f7786bf
- SHA1 d76a82f148e8eb29ec384768ab1cd4648022f7d2
- SHA512 8e54294f8c58c9ed597e74a3c9c656977c59a051f3229b97029da5d082e8dd9a75b9ef1e3bc64e0964530b67dfcfe9b65a08d50ce6fcac377948aaf4aa45d6b4
- SSDEEP 12288:NH5FlUsvD1PyvJQ5QW50K8VPDNOQ3SCmPs:Fqw16vJ2950K8V5ObCmPs
- TLSH
  T15DB44A1EEEA26435888002497FBE4128BC1E83540B6FB5AB6CCF9D91217577ECEF4D58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15
- Target
  locales/da.pak
- Size 468KB
- SHA256 45f036a650bb91a3812646b8fac57df10956d75e1bdb85a8067cc16c7d56c428
- MD5 9aa3750deb43d8432ca826523a831f11
- SHA1 a8f97b978ea43f47b2c471bf6ec451901bd9ac7f
- SHA512 e4bba53992f482b75fc394d813dccd04f83fcec8e5040d640e37ef9ea3eba6d93feb96399bc174d2b74a6c37ff057272ecba2db02b8aa5f3bf0113134d3b6d7a
- SSDEEP 6144:TiOAtdgpzV0qV5cU3HVEs7a7wlTwUJwa7obRR2vJub5/NrXBDUd4vTGqfwI:TibkzHzaoQR5Vr3Tpz
- TLSH
  T14EA44A4B9C9C732F89AD4B65F3108DA7EB5D543CC680264FA5D8943A0ACFC6097BE1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16
- Target
  locales/de.pak
- Size 499KB
- SHA256 e92b111a23bfac2ffe3cd0603ab31096a296343059dfdb606c4f71600ad00807
- MD5 b29e2350901a6e9b5db5c43abb9e6ffd
- SHA1 f7bd8f2674de562c0fe48b9a6efbb1168169c7ed
- SHA512 e359d964deb19a3b2a634cc35bb78b951bd249097e9e4f7eed1ab8448b8bb7c5f976a3a2e5501813fe4bf0dd4a3fa92a1b6ca7431c8ce04a5be992b8006a4715
- SSDEEP 6144:NbDzb9EkvgnfsMuxRnY43K7Up7aD3gXra/n3RaILL3AnO1a265iM5vRvmTzMRTIZ:NbxxvKsde43K7UpugbaPBSwS56m8CCga
- TLSH
  T13AB40703ADDF625EC78673613305CDB77B19E26BC346312688EDD13B660B5B282AC536
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17
- Target
  locales/el.pak
- Size 907KB
- SHA256 aa71a264558696cc04ab62c6c6ecb0a0c307a98d2ae5755b8cff2bea5ed255cd
- MD5 ef13645b41573efa9ecb292cde3cc64e
- SHA1 39e12854334d96b25a61a1e4f7cd9f5f39fb1a8d
- SHA512 335b77e3adbb7e6329a2614634a5c2ef9fea705414b57bd380147863df3fd7c6dd5d809419ad3e1469319621edfdd4fef048fbd1f36737ea1da08515baa6ecea
- SSDEEP 24576:TBtbxYcXPdFgx11KxiMc9u2JXDsSYSmqHMuD2fpBLOj3BAVH8+Vdc7tNDQo3sEtP:nbxYcXPdFgx11KxiMc9u2JXDsSYSmqH5
- TLSH
  T15B15BFEFB4542DED8086950785D8F07C6BC62D6CE749CBD86629CB60BDF80718A22D1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  locales/en-GB.pak
- Size 408KB
- SHA256 2ffb3d6354131844f41a629697b8bfff23ad53d4f849a30f1426a7de31cec56d
- MD5 a3f73c57754239c916314067aeec7e7d
- SHA1 f20a2781daf583906054c0e1b7f7004a4a99a234
- SHA512 ecb2fbbd66322c9802e507c50f4bad0ad8f266d616cf13f00df7293adeadd7297de56dcadc6348caf2af0fd520745dc2ebc01ae7e9a73c0833527387d0003e67
- SSDEEP 6144:pZWq7hqlh7GMP9eRn/LfaY1+/845pDSQBE0RbhU:z3uGMun/7o5pSsU
- TLSH
  T1B3943C1FF744226A069312627B0AA6A2FF26D06CB35116563CBD802C33B6756C3777E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19
- Target
  locales/en-US.pak
- Size 411KB
- SHA256 e4f1a09dd11cd6686aabe1cf51e6ede6028667725471fc59ff38354cd9590c9d
- MD5 bfbe0fa420b8db37cb9aeb78bb65f3b5
- SHA1 73b75d327238abaf25b13525aa9bd5f52c822d4d
- SHA512 4d73bb4054aeda3a5feb69018cba636e9192306bc2787778a03c8d829437d6f1ee90087b1a3e57c230469e68fa232a87469546040f6495bdf9d8c4b99fb22758
- SSDEEP 6144:Oa7qHeKLe9gOmUp/9meKMP9e7X9ifaY3yzq5JdSKn0F/lOSwH:9Boe/bKMwX9cj5nSwSwH
- TLSH
  T16C945C1FF744226A069352627F0996B2BF32D06CA35112563CBD812C33B7B66C3776E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral20
- Target
  locales/es-419.pak
- Size 496KB
- SHA256 e8b21712259df34917149cb3c7804a93d80065f95c35512a7c0ae55c3613773a
- MD5 28933b5595a54ca306b49c91f6a2670b
- SHA1 b47e8ca0c81fd23b284b11a6b93b74b589c79f45
- SHA512 4df2efd6527d320963f8faf825f4a8a32bf4abc84b90ff2cf6f0e48c25f6e859522312abcae5aab06f4c14d4bcd536ef8345e605629455cf6cfcb3076fca1465
- SSDEEP 6144:DvhPA15FxN8P4i8lRp5YrmB5mLFENIKYA:xU5Ow7p9B58Fx7A
- TLSH
  T19EB41A22BAC81F5310E2A389B783D753E4989545F408C29BE9EB876512CCF8CC977ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21
- Target
  locales/es.pak
- Size 495KB
- SHA256 4db78987dd4a4d6c508aa9322a67d110926618aefba14fd5ec0c4f7bbf38cae5
- MD5 c8c72e965d87c26773feb74fb4a73cf7
- SHA1 1d5c0f9d8fbaaed95203d9c92547db7211ab293c
- SHA512 66a2077fb1f37ee9b8ec80677a066934eec6ebd9be57a460d708a322018cf07f3986b798e178c1b44d5d9a2ea6a91d0fdff4a701e59ec0a83387679d546975cf
- SSDEEP 6144:bC8D08xLQrx1+hM73RgTEqpF+E8y1w4Fj05farw3osZQ6PZjHu:+8X0riq7Wnp4y1wEj05Cr2osPO
- TLSH
  T105B40922AACC1F6350D39389B783D753E4989585B408C29BD8EF876612CCF8CC967ED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral22
- Target
  locales/et.pak
- Size 449KB
- SHA256 53be055fb30bc22f428d965ed909b241e995080cbce9d6a763ca7db561ea48a8
- MD5 fa3d0a2f957adfc4edab17a3da985da1
- SHA1 5b4e9ba195495e53e782a187c621cfa097a4aee0
- SHA512 94db969c063781004cc4cd2bf70665acd840b7f29b1e21298c355aee341a112f8ea832fe0421d59142e0a5ae9048a722371920196ea4300bc0dd5c190fd8dae3
- SSDEEP 6144:iRTh/T/LituCJ1ONRCOeP+DEmThFC0jmFohH7fSpY0lgtim0DM52ju43sPZCfLab:cTh/bLOunrewtHmFoh09M52j+x
- TLSH
  T146A43B42617E771B182452F9D337AD23CC9EE7D8B4000D97AC964A1D61EEF8C38B6B58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23
- Target
  locales/fa.pak
- Size 737KB
- SHA256 31fb604cd4e35d749e2f6f5d72422190209f6fc705e48dbb9bfba115d4c172c8
- MD5 c33e3c9efca7ddcffb36bc1133e6095a
- SHA1 e32f4eddb322fa0d870028a1aba71119907d35f6
- SHA512 83b830b1540f919b6d661fa3c7f261bd840974057decefdc348bc10eb0383b6b0b9bafb49a0f746b4b0735dd77583df4d0bec6a4ae6012dab3510df2b7ea1517
- SSDEEP 12288:1/iwNb+38u313uyqoe+slXcfqEdvRmXzoT4WmdAQifaQ2XxFvGk62BtMX9OxRdp7:db+38u313uyqoe+seqIvRmXzoT4WmdA8
- TLSH
  T1E1F4C3956AAC9AB16757CA0341D33834C773EF12D34DFE40ACA1076609A5B139F4EA3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral24
- Target
  locales/fi.pak
- Size 459KB
- SHA256 3f4917da84f78778a81e5f5b64b2c206e511fcbc942dacd22348c82ffa7e2dd4
- MD5 d5555b9c7c0b230ed10520b4439be774
- SHA1 724677b758376485f40e0064474c2530ecca17de
- SHA512 240d1e6ff9e35d8a28780756dc35ccf5ed515f20fc8dee01cc4561db9ed9969545452cebc9584beba0c3fcb657be2cdb76789ca9f6a98793c6e2ec7742c4852c
- SSDEEP 6144:3KlTy119i//8e36LTFh2TRtrZs6TIOEysaIuLL5RYWyHrE5WacpoPWmMWO4AMTX0:38y119S/r50a35RYdHrE5WaipKYn
- TLSH
  T158A45D915219C22137C4D28E7DB0903EF5E9E3DCCC288D9AE943C7D949E99883D7276E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral25
- Target
  locales/fil.pak
- Size 519KB
- SHA256 98293378007df4fb9a842de7608fef8580f59419d5778ebb5879d6997f1a095d
- MD5 24858a34de2b52a57b13fa3212c112ba
- SHA1 0cd8ff86d2cacb6201115edc30059f339b905794
- SHA512 87308776c125f92f862211b420413d0802e509dbf3cc6873b4458ec3e2dbe1faabcf86d2bffc4b9fc8e8ec772147bf54543b79e8a22a522c59b5ed7ac13607c9
- SSDEEP 6144:87Pn6vThIccitD/ty3DQZIbpiWFevNnGFZ338mC5rVms68ARrq8:87PnoFBodn7C5Zm7
- TLSH
  T1E2B4B611B7402748DBC352E52360682F66E560BC3F827C6E4FBF269B6BA7CD5D270192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral26
- Target
  locales/fr.pak
- Size 537KB
- SHA256 cdbf514aaaa4f1dd044a2cfb48211273ad11d67fe1a0a11d26a93460ffdeba0d
- MD5 a21baa41409b6d326d9607d427ae0510
- SHA1 add97bf646fb0a1e4e935d4b56c3715d87dfe22b
- SHA512 b08838f09e4d4f14947590171e09aa7f1f29a55e9a74219e5ed5d4f589fdbc009cb11ef9493d53e0f6acf2ac280c4188bbd13572f32771465c58e7ea85a081e0
- SSDEEP 12288:LRu4f6FZLiQphDDq6QuaMV5wKzQOtX1Z/MYnYtY2XfyzYi5Qx0JSWkv40wCm7x+Q:VDjsVIv56
- TLSH
  T162C4E55FADC432CB19C612B3FB12D663DD348248F216E340D89F4695129A8ECD39F6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27
- Target
  locales/gu.pak
- Size 1.0MB
- SHA256 016b9b8154eb0bfa301b9274054d2f6b58da0672821b419a3ffc6ab968f885c8
- MD5 b2737893aca922c953fe3084fb343001
- SHA1 ce19960333445aba648c323b6d3adaa831d83680
- SHA512 5a5407395208bed986484c0d6adc1cb4e04af596c1d117888115a1f7bceb15e3bb9e0cd298556bb00b7a832d9c0c380a071ffcd212346300f3d14d9ba7909793
- SSDEEP 3072:9Ran/YMJtXW5zQaX/HIwjAwREJKVMjNiT7llj63rFWlPvpMi5eQWiYJ+WR6/GQoL:9MQ8yzQaza4/WP5c/h6vHX
- TLSH
  T1633518D0D3B9F07119DA9F7E819E512086695343D67E230051CEEE898801DDF3EEEA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral28
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29
- Target
  vk_swiftshader.dll
- Size 4.9MB
- SHA256 10411f9a38ee2df37d8f12fc8adb47eb653abff5b3cd8a80260ff55490698a21
- MD5 2f6472bde9564b1d724921030c1ac0ee
- SHA1 ed7d36bf40baeba966f10622898cf062980e7b09
- SHA512 cc18004095dcf80f974a5f1668ed05f9ef7f04a70376fd4c4874f6cfecc3c8e768a6cc83b93272862ed76b221f08b87f8050b1f4af16286fa3e3fb9ad84a1284
- SSDEEP 49152:ECmSoph1oXdU3quTN+f6x/o6j/PESEekzcgtlTRHAdOf75MZfEy0gUZVthW5C1Zp:lmSoAal17OrHKkz6VA2oyLe
- TLSH
  T18E363803B28581D9F05DD5B94B4BA632F631F8811B62B6DF52A41F192E37FE02B39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  vulkan-1.dll
- Size 931KB
- SHA256 982d9aedc579a34035e15b3a425e605676937843e65f3b7157f805d434902ca6
- MD5 0e2052834469221a5128ed56eed861a3
- SHA1 cd6bdbfb65dfb70086613df584b60b8929ecdca3
- SHA512 66f331e523de113c2117d64e9542e3acb9fba170d2a3294179bda27c9b07fb7796cd16afefa4fe2f3aa51f961fa3ca69b1f251fca0258f45f6b3efe779121714
- SSDEEP 24576:GPZePxVv0mdcSoDCraWwIQ6Z5WoDYsHY6g3P0zAk7sD:GPYnv5oDCrQJ6Z5WoDYsHY6g3P0zAk7s
- TLSH
  T1E8156D13AA980569D476C034C9C28707C9B578921726B9CF03E81B196F6BFF4773DB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32